asyncrat | 4cf174b3ba8fea84e43f5451abeae2acbf2cf76fee346bc8c0eaec44fbdad07c

Sharing

Copy URL Twitter E-mail

General

Target
4cf174b3ba8fea84e43f5451abeae2acbf2cf76fee346bc8c0eaec44fbdad07c
Size 45KB
Sample260714-lp5khscw9v
SHA256 4cf174b3ba8fea84e43f5451abeae2acbf2cf76fee346bc8c0eaec44fbdad07c
MD5 2b498fc1a6094804ce0781f9b8bb3217
SHA1 dfb6f4771937588ad6467925688386ebcde8a1aa
SHA512 451ea01eafe368c1ad7a47b08794fdb3f332b5f04fb66b566b7f4bdf17a2c7ccb157e6f670c48989399fbe5b193917b22b61e0d6ba05d247a5e6581d8299e92f
SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwJ3XoPEayPIFzjblgX3i/akaI7/z6BDZMx:ku40ZTXEb2VmEabF3biXSCkaGYdMx
TLSH
T190233B003BE8812BF2BE4F78A9F26145867AF5733603D5491CC451DB5A13FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

cdn.cd-vs.com:80
cdn.cd-vs.com:22
cdn.cd-vs.com:8080
cdn.cd-vs.com:8880
cdn.cd-vs.com:2052
cdn.cd-vs.com:2082
cdn.cd-vs.com:2086
cdn.cd-vs.com:2095
cdn.cd-vs.com:443
cdn.cd-vs.com:2053
cdn.cd-vs.com:2083
cdn.cd-vs.com:2087
cdn.cd-vs.com:2096
cdn.cd-vs.com:8443
www.cdn.cd-vs.com:80
www.cdn.cd-vs.com:22
www.cdn.cd-vs.com:8080
www.cdn.cd-vs.com:8880
www.cdn.cd-vs.com:2052
www.cdn.cd-vs.com:2082
www.cdn.cd-vs.com:2086
www.cdn.cd-vs.com:2095
www.cdn.cd-vs.com:443
www.cdn.cd-vs.com:2053
www.cdn.cd-vs.com:2083
www.cdn.cd-vs.com:2087
www.cdn.cd-vs.com:2096
www.cdn.cd-vs.com:8443
emotet.cdn.cd-vs.com:80
emotet.cdn.cd-vs.com:22
emotet.cdn.cd-vs.com:8080
emotet.cdn.cd-vs.com:8880
emotet.cdn.cd-vs.com:2052
emotet.cdn.cd-vs.com:2082
emotet.cdn.cd-vs.com:2086
emotet.cdn.cd-vs.com:2095
emotet.cdn.cd-vs.com:443
emotet.cdn.cd-vs.com:2053
emotet.cdn.cd-vs.com:2083
emotet.cdn.cd-vs.com:2087
emotet.cdn.cd-vs.com:2096
emotet.cdn.cd-vs.com:8443
wannacry.cdn.cd-vs.com:80
wannacry.cdn.cd-vs.com:22
wannacry.cdn.cd-vs.com:8080
wannacry.cdn.cd-vs.com:8880
wannacry.cdn.cd-vs.com:2052
wannacry.cdn.cd-vs.com:2082
wannacry.cdn.cd-vs.com:2086
wannacry.cdn.cd-vs.com:2095
wannacry.cdn.cd-vs.com:443
wannacry.cdn.cd-vs.com:2053
wannacry.cdn.cd-vs.com:2083
wannacry.cdn.cd-vs.com:2087
wannacry.cdn.cd-vs.com:2096
wannacry.cdn.cd-vs.com:8443
ursnif.cdn.cd-vs.com:80
ursnif.cdn.cd-vs.com:22
ursnif.cdn.cd-vs.com:8080
ursnif.cdn.cd-vs.com:8880
ursnif.cdn.cd-vs.com:2052
ursnif.cdn.cd-vs.com:2082
ursnif.cdn.cd-vs.com:2086
ursnif.cdn.cd-vs.com:2095
ursnif.cdn.cd-vs.com:443
ursnif.cdn.cd-vs.com:2053
ursnif.cdn.cd-vs.com:2083
ursnif.cdn.cd-vs.com:2087
ursnif.cdn.cd-vs.com:2096
ursnif.cdn.cd-vs.com:8443
azorult.cdn.cd-vs.com:80
azorult.cdn.cd-vs.com:22
azorult.cdn.cd-vs.com:8080
azorult.cdn.cd-vs.com:8880
azorult.cdn.cd-vs.com:2052
azorult.cdn.cd-vs.com:2082
azorult.cdn.cd-vs.com:2086
azorult.cdn.cd-vs.com:2095
azorult.cdn.cd-vs.com:443
azorult.cdn.cd-vs.com:2053
azorult.cdn.cd-vs.com:2083
azorult.cdn.cd-vs.com:2087
azorult.cdn.cd-vs.com:2096
azorult.cdn.cd-vs.com:8443

Mutex

DQPq9YZLb1oi

Attributes

delay
0
install
true
install_file
q5fd1.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  4cf174b3ba8fea84e43f5451abeae2acbf2cf76fee346bc8c0eaec44fbdad07c
- Size 45KB
- SHA256 4cf174b3ba8fea84e43f5451abeae2acbf2cf76fee346bc8c0eaec44fbdad07c
- MD5 2b498fc1a6094804ce0781f9b8bb3217
- SHA1 dfb6f4771937588ad6467925688386ebcde8a1aa
- SHA512 451ea01eafe368c1ad7a47b08794fdb3f332b5f04fb66b566b7f4bdf17a2c7ccb157e6f670c48989399fbe5b193917b22b61e0d6ba05d247a5e6581d8299e92f
- SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwJ3XoPEayPIFzjblgX3i/akaI7/z6BDZMx:ku40ZTXEb2VmEabF3biXSCkaGYdMx
- TLSH
  T190233B003BE8812BF2BE4F78A9F26145867AF5733603D5491CC451DB5A13FC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2